H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Reaver](https://attack.mitre.org/software/S0172) is a malware family that has been in the wild since at least late 2016. Reporting indicates victims have primarily been associated with the "Five Poisons," which are movements the Chinese government considers dangerous. The type of malware is rare due to its final payload being in the form of [Control Panel](https://attack.mitre.org/techniques/T1218/002) items.(Citation: Palo Alto Reaver Nov 2017)

Labels

malware

14 recorded

Relationships

uses

to Archive via Custom Method

Technique

uses

to Control Panel

Technique

uses

to Encrypted/Encoded File

Technique

uses

to File Deletion

Technique

uses

to Local Storage Discovery

Technique

uses

to Non-Application Layer Protocol

Technique

uses

to Query Registry

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Shortcut Modification

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Web Protocols

Technique

uses

to Windows Service

Technique

3 external

References

mitre-attack

S0172

Reaver

—

Palo Alto Reaver Nov 2017

https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/